Analysis
-
max time kernel
151s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-12-2022 14:53
General
-
Target
b5a8f27b7cbd207386168a43f3f0ee85a18863fcb4c7fedefc3a978f9c919926.exe
-
Size
297KB
-
MD5
942ff8a9066bdd69149f5412636ffd6e
-
SHA1
a67e488f806352d53d867d479d1898a7886014e0
-
SHA256
b5a8f27b7cbd207386168a43f3f0ee85a18863fcb4c7fedefc3a978f9c919926
-
SHA512
cc80f725ca9c9a1ede7f2684f522665998363a4ea582e729b1444047fd330c6b228573f858142b4dd9d6409e76cb90fc031a26df0e0ae3005f552489a40cf887
-
SSDEEP
6144:8aeL3R/8NFXdE4HUEhz34IUTXLC58xQ3xDPkMo5zXbAc:tezR+Xm4HUIz/uLC58xaxDPyrbA
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5a8f27b7cbd207386168a43f3f0ee85a18863fcb4c7fedefc3a978f9c919926.exe"C:\Users\Admin\AppData\Local\Temp\b5a8f27b7cbd207386168a43f3f0ee85a18863fcb4c7fedefc3a978f9c919926.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6A24.exeC:\Users\Admin\AppData\Local\Temp\6A24.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4576 -ip 45761⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5d373cd3842e557eb94ccda95253541d9
SHA14d734ca72dbaa20ed73613dc5ed65fa1415afe5f
SHA256adf1bc801b650274a3c62a61d0ba8061c7a114a6543e504da620a1ef306c0c0f
SHA512cfa60f07d15f5428bfbfe52d8bdb993da4c6155d0ae50e91b70cd9c4731b7b07e01686c5368e01bb67cfe18c64a0ab39cee899f490d765abd07293bf6c2e4f22
-
Filesize
1.0MB
MD5d373cd3842e557eb94ccda95253541d9
SHA14d734ca72dbaa20ed73613dc5ed65fa1415afe5f
SHA256adf1bc801b650274a3c62a61d0ba8061c7a114a6543e504da620a1ef306c0c0f
SHA512cfa60f07d15f5428bfbfe52d8bdb993da4c6155d0ae50e91b70cd9c4731b7b07e01686c5368e01bb67cfe18c64a0ab39cee899f490d765abd07293bf6c2e4f22
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
-
Filesize
1.1MB
-
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
88KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
36KB